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EDUCATION LEADERS REPORT 


Advancing Personalized Learning 
through Effective Use and Protection of 


Student Data 


By William Tucker and Don Long 


With roots in student-centered pedagogies that go back at least to the 1900s, personal- 


ized learning meets students’ learning goals, needs, context, and pace while incorporat- 


ing their interests and preferences. Personalized learning in today’s classroom depends 


upon and creates an abundance of rich student data, which simultaneously fosters new 


opportunities for learning and creates fresh concerns over student data privacy. 


On the one hand, data to support person- 
alized learning are used to monitor student 
progress and support customized instruc- 
tion in real time. They also aid in evaluating 
students, teachers, and programs over lon- 
ger periods. Digital tools make it easier to 
customize instruction and assessment for 
continuous improvement, expand access 

to a wealth of content and experiences, and 
engage students through a greater variety of 
modalities of learning. Empowered by data, 
students, parents, leaders, and teachers can 
individually and collectively match individ- 
ual supports and opportunities to student 
strengths and needs. 


Linda Howard, a sixth-grade English 
teacher in Fall River, Massachusetts, 
describes her approach to personalized 
learning, where students rotate between 
working online and face to face: “T get to 
work with small groups a lot more. I un- 
derstand my kids so much better now,” she 
said. “Working with them individually and 
having their data from i-Ready [one of the 
school’s digital content providers] has re- 
ally opened my eyes to each kid’s strengths 
and weaknesses.”! 


On the other hand, personalized learning 
relies increasingly and heavily on digital 
technologies to gather and store student 
data. The technologies thus intensify con- 


cerns about commercial influence in educa- 
tion generally and about third-party access 
to and potential misuse of student data in 
particular. As authors from the National 
Education Policy Center put it: “As schools 
continue to integrate technologies into ev- 
ery aspect of school life, those technologies 
are being harnessed to amplify corporate 
marketing and profit-making, extending 
the reach of commercializing activities into 
every aspect of students’ school lives.”” 


This panoply of possibilities and concerns 
creates a challenge for policymakers.° 
Numerous state and federal laws exist to 
protect student privacy and ensure that 
student data are not shared inappropri- 
ately. These policies, however, have been 
established piecemeal over time, creating 
confusion for schools that want to imple- 
ment personalized learning models. 


Existing federal laws—the Family 
Educational Rights and Privacy Act 
(FERPA), the Protection of Pupil Rights 
Amendment (PPRA), and the Children’s 
Online Privacy Protection Act (COPPA)— 
have proved difficult to keep up to date as 
technology changes. While the federal law 
plays a critical role in providing a broad 
framework, it can only supplement the 
states’ role in developing consistent and co- 
herent policies, suggests the Data Quality 


Campaign.’ States are better positioned 
to develop laws that reflect state priorities 
and values and that incorporate diverse 
stakeholder views on how best to balance 
data access and privacy. 


States have passed a slew of legislation in 
recent years to address student data priva- 
cy. Since 2013, 49 states have introduced 
503 bills, and 41 states passed 94 laws on 
the privacy and security of student data, 
according to the Data Quality Campaign.° 
In 2017, data access and privacy contin- 
ued to be a focus, with 107 bills being in- 
troduced by 38 states, and 30 passed into 
law (see map). Although these laws are 
not uniform in scope or aim, they govern 
what sorts of data may be collected, who 
may access that data, and how student 
information may be used. 


Each of these new laws increased student 
data privacy protections, making the 
collection of specific pieces of student 
information more difficult for classes of 
interested parties. The tug-of-war over 
student data may sometimes be a zero-sum 
game: Increased protection on one side 
may result in a corresponding loss of 
access on the other. Overreaching in this 
space can increase security surrounding 
student records at great cost in terms of 
lost opportunities for learning. 


The most progressive laws and policies 
allow parents and students the autonomy 
to make decisions. At a minimum, schools 
and districts that allow personalized learn- 
ing programs should ensure that student 
information is shared in a secure way that 
respects student privacy and is no more 
invasive than necessary to achieve a learn- 
ing goal. At the same time, students and 
parents should be able to opt into such an 
exchange—a policy that fosters trust and 
encourages involvement. 


The best laws and policies also recognize 
the value inherent in personalized learning 
and provide infrastructure for safe access 
to a predetermined, transparent set of 
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data. Such policies advance both access 
and protection and stand in contrast to 
laws and policies that unilaterally restrict 
opportunities to participate. The constant 
flow of new applications that use student 
data as avenues for increasing student 
achievement calls for laws and policies that 
leave room for growth and innovation. In 
contrast, policies that restrict data use run 
the risk of stifling innovation and prevent- 
ing students from realizing its benefits. 


The coupling of states’ commitment to 
preparing all students for postsecondary 
success with technological innovation 
makes personalized learning possible at an 
unprecedented scope and scale. Interest is 
rising in districts, at the federal level, and 
in the philanthropic community. The U.S. 
Department of Education has provided 
over half a billion dollars to districts in 
support of personalized learning. The Bill 
& Melinda Gates Foundation has com- 
mitted $300 million since 2009 to support 
research and development, and the Chan 
Zuckerberg Initiative in 2015 promised 

to invest substantially in personalized 
learning across multiple fronts. In addi- 
tion, more than 3,100 district leaders have 
signed the “future ready pledge,” sponsored 


by the Alliance for Excellent Education 

to help districts achieve college- and 
career-ready goals for all students. With 

it, the districts commit to transforming 
instruction through leveraging technology 
to personalize learning in the classroom. 


The intensifying demand for personalized 
learning raises the stakes for states and 
districts to develop policies that support 
the timely, effective use and protection of 
the student data that are fundamental to its 
success. It is also imperative to eliminate 
policies that impede personalized learning. 


WHY PERSONALIZED LEARNING? 

To understand the urgency for effective 
state policies to address the data privacy 
concerns raised by personalized learning, 
it is essential to understand personalized 
learning’s promise and challenges. In 2015, 
RAND found that students attending 
schools with robust personalized learning 
models “made gains in mathematics and 
reading over the past two years that were 
significantly greater than a comparison 
group made up of similar students.” ° 
Students were also more likely to report 
they had engaged in complex, student-cen- 
tered instruction. Increased graduation and 


States That Considered and Passed Laws to Guarantee Access 
or Protect Privacy in 2017 


I considered a bill but has not yet/did not pass it 
BB passed a law 
neither passed nor considered a bill 


Source: Data Quality Campaign, “Education Data Legislation Review: 2017 State Activity” (September 2017). 


college completion rates were associated 
with school districts implementing these 
innovative school models. 


In a 2017 study looking at a different 
sample of schools with less experience with 
personalized learning, RAND researchers 
found that implementation varied consid- 
erably across schools and resulted in less 
significant student gains. The schools with 
the most improved student outcomes were 
those that implemented all of the following: 
grouping students by data to meet their 
needs, using data to engage students in re- 
flection of their learning progress and goals, 
and providing environments that supported 
the personalized learning model.’ One 
conclusion is that context and implemen- 
tation—the “how”—matters. Similarly, a 
report of the National Center for Learning 
Disabilities found many benefits for stu- 
dents in special education from personal- 
ized learning, each with an accompanying 
implementation challenge.® 


It is also important to put the “why” of 
personalized learning in an equity context. 
Despite its aspirations for the success of 
all students, the U.S. education system 
remains unique among developed nations 
in giving the least to those with the least.’ 
International data show that the nations 
that make the greatest investments in the 
education of their most disadvantaged 
students also have the highest performance 
on the Programme for International 
Student Assessment (PISA) tests.'® 


Compared with their more advantaged 
peers, high-poverty and minority students 
in the United States are more likely to be 
food insecure, more fearful for their safety 
inside and outside of school, and face high- 
er levels of educator turnover that deprive 
them of consistent adult relationships in 
school.'' These students have dispropor- 
tionately less access to technology and out- 
of-school experiences that can be leveraged 
to facilitate student-centered pedagogies 
like personalized learning.’ Along with 
higher levels of need, they experience lim- 
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ited access to high-quality leaders, teachers, 
and other staff, as well as infrastructure and 
programs, a situation that poses significant 
obstacles to personalizing learning using 
best practices. The renewed interest and 
experimentation in personalized learning 
must be grounded in fully addressing these 
equity challenges (box 1)."? 


WHAT IS PERSONALIZED LEARNING? 
As is to be expected in any period of tran- 
sition and creative ferment, there are com- 
peting definitions of personalized learning, 
each placing different emphases on the 
roles of students, teachers, and technolo- 

gy. Although almost universally praised, 
personalized learning has not generated 
consensus around any one definition." For 
years, the term personalized instruction 
was not distinguished from individualized 
or differentiated instruction. More recently, 
terms such as “deeper,” “student-centered,” 
or “blended” are used interchangeably with 
“personalized” and add to the confusion of 
those trying to analyze its utility and opera- 
tionalize it in classrooms.” 


Earnest yet largely inconclusive attempts to 


crystallize the term have prompted some to 
call for a moratorium on further attempts.’® 
But there are several excellent candidates 
for a consensus definition (box 2). 


The lack of clarity in defining personalized 
learning is consequential. It impedes policy 
development and alignment across all 
components of an education system—cur- 
riculum, materials, assessment, account- 
ability, and leaders and teachers—which are 
needed for scaling and sustainability.'” And 
where personalized learning is absent from 
the classroom, educators are forgoing “a 
way to engage and motivate young learners, 
deepen their interactions with academic 
content, and achieve the positive outcomes 
that pave the way to long-term success." 


The multiple definitions or sets of criteria 
for personalized learning provide a dynamic 
and multifaceted but confusing amalgama- 
tion of competing values, interpretations, 
and uses, each emphasizing different edu- 
cational goals and purposes, attributes, and 
learning environments. At the same time, 
personalized learning may place unrealis- 
tic demands on teachers and leaders, who 


already face increasing expectations and re- 
sponsibilities. The typical U.S. schoolroom 
has an average 1:19 teacher-student ratio.” 
That one teacher is expected to convey a 
body of content to each of the increasingly 
diverse group of students in a classroom 
within a limited period—all while cultivat- 
ing a set of skills and dispositions. Leaving 
personalized learning amorphous and un- 
clear therefore not only hinders policy and 
research but also may undermine educator 
and public interest and support. 


DIGITAL TECHNOLOGY AND 
PERSONALIZED LEARNING PLANS 
Personalization occurs as a matter of 
course in classrooms throughout the 
country—with and without the aid of 
digital tools. But it is hard work to give 
each student a different “touch” to guide 
their learning, so many students do not 
experience personalization regularly or at 
all.?° In a 2005 study on a related stu- 
dent-centered pedagogy, differentiation, 
the National Research Center on Gifted 
and Talented found that “the ‘vast ma- 
jority’ of teachers never moved beyond 
traditional direct lectures and seat work 


Policy Recommendations for Equal Access to 
Personalized Learning 


¢ Expand and improve high-speed, broadband connectivity to ensure 
student opportunities for anytime, anywhere learning by 


3 examining contracting strategies and pooled purchasing agreements to 
support cost-effective contracting for schools and districts; 


3 allowing any K-12 education program in the state to buy off of state- 
wide enterprise contracts to maximize telecommunications invest- 


OER. 


baseline and longitudinal data to measure student growth over time 
to promote continuous improvement. 


¢ Ensure content, learning materials and professional development 
resources created with public funds are made publicly available as 


ments with public dollars and E-Rate funds; and 


9 exploring state strategies to make free or discounted broadband con- 
nectivity available to economically disadvantaged students at home and 
in their communities for anytime, anywhere learning. 


9 supporting the development of data systems aligned to personalized, 
competency-based learning. 


e Develop state data systems to collect, in real-time, standards-based, 


e Include OER on approved state instructional materials lists and sup- 
port the development and maintenance of openly licensed instruc- 
tional materials aligned with state standards. 


¢ Establish policies for the protection and good governance of student 
data privacy and avoid prohibitions that could have unintended 
consequences for the ability of educators to personalize learning. 


Source: iNACOL, “Meeting the Every Student Succeeds Act’s Promise: State 
Policy to Support Personalized Learning” (Vienna, VA: 2016). 
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for students.” The challenges to person- 
alizing learning include lack of proper 
teacher and leader preparation, profes- 
sional learning, and ongoing support. In 
addition, educators face complex realities: 
large class sizes, limited materials, lack of 
time for planning and collaboration, and 
an expanding scope of responsibilities. 


Digital technology can address these 
constraints and ramp up the opportunities 
for customization. Because they are best 
positioned to measure the relative impact 
of personalization techniques, teachers 
tend to be the biggest proponents of per- 
sonalized learning platforms. According to 
a Bill & Melinda Gates Foundation survey 


in 2015, “The majority of teachers reported 
that they believe that data and digital tools 
make them better teachers,’ and “nearly 

7 in 10 teachers (69 percent) surveyed 
believe that tailoring instruction to meet 
the needs of individual students is re- 
quired to improve student achievement.” 
According to a Rhode Island Personalized 


Defining the Term 


Online-learning association iNACOL defines personalized 
learning as “tailoring learning for each student's strengths, 
needs, and interests—including enabling student voice and 
choice in what, how, when, and where they learn—to provide 
flexibility and supports to ensure mastery of the highest stan- 
dards possible.” 


Another approach is to identify defining characteristics of 
personalized learning: 


¢ begins with the individual learner and their journey; each learner 
brings their unique history and context to each experience; 


e frequently motivated by relationship and activated in community; 


¢ occurs most fully when it engages all of a student’s senses, emo- 
tions, and intentions; 


« learners bring unique interests, motivations, and ways of learning.” 


The Rand Corporation has developed criteria for identifying 
personalized learning: 


Leading practitioners in the field generally look 

for the following: (1) systems and approaches that 
accelerate and deepen student learning by tailoring 
instruction to each student's individual needs, skills, 
and interests; (2) a variety of rich learning experi- 
ences that collectively prepare students for success 
in the college and career of their choice; and (3) 
teachers’ integral role in student learning: designing 
and managing the learning environment, leading 
instruction, and providing students with expert 
guidance and support to help them take increasing 
ownership of their learning.° 


“Personalizing learning,’ the term preferred by 
David Hargreaves, emphasizes that it is a process, 
not a thing.‘ 


Jobs for the Future compiled, synthesized, and analyzed hundreds 
of research articles to ground its four overlapping, complementa- 
ry principles of “student-centered, personalized education”: 


e personalized: providing learners with high-quality instruction 
customized to their needs and interests and emphasizing connec- 
tion between personal relationships and learning; 


¢ competency-based: enabling learners to advance to the next 
level, course, or grade based on demonstrations of their skills and 
content knowledge; 


e anytime, anywhere: providing learners with opportunities to 
learn outside of the school and the typical school day; and 


e student-owned: encouraging and supporting learners to take an 
active role in defining their own educational pathways. 


In sum, personalized, learner-centered approaches (the “how”) 
are the way to achieve deeper learning competencies (the 
“what”) in order to prepare all students for meaningful work, 
lifelong learning, and civic participation.* This understanding 
can guide a systemic approach to personalized learning that 
can guide policymaking. 


a. Susan Patrick et al., “Defining and Integrating Personalized, Blended, 
and Competency Education” (Vienna, VA: iNACOL, October 2013). 


b. Tom Vander Ark, “15 Dimensions of Personalized Learning, 
Getting Smart blog (September 12, 2017), http://www.gettingsmart. 
com/2017/09/15-dimensions-of-personalized-learning/. 


c. John. F. Pane et al., “Continued Progress: Promising Evidence 
on Personalized Learning” (Santa Monica, CA: Rand Corporation, 
November 2015), on file with author. 


d. David Hargreaves, “The Final Gateway: School Design and 
Organisation” (London: Specialist Schools and Academics Trust, 2006). 


e. Rebecca E. Wolfe et al., Anytime, Anywhere: Student-Centered 
Learning for Schools and Teachers (Boston: Harvard Education Press, 
2013). 
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Learning Initiative white paper, “Teachers 
recognize that a one-size-fits-all instruc- 
tional model is inequitable and not aligned 
with the educational needs and rights of 


individual students.””* 


A former Google executive and current 
CEO of learning company Gooru, Prasad 
Ram, explains the dynamic of technology 
and metadata this way: “At every interac- 
tion, Gooru captures usage data, social sig- 
nals, and learning outcomes, which are used 
to develop user profiles, inform recommen- 
dation algorithms, and provide teachers 
with tools to deliver personalized learning 
to their students.’** Companies like Gooru 
provide tools to apply “big data” principles 
to “transform the small classroom.” 


Even as personalized learning platforms 
become the “new normal,’ the technology 
and techniques behind these tools contin- 
ue to develop, and thus so do the data that 
will inform teachers and students.”° For ex- 
ample, DreamBox, makers of an adaptive 
learning tool, claim it personalizes student 
learning by producing multiple pathways 
for student achievement. An adaptive 
learning system “simultaneously assesses 
and instructs in real time and tracks the 
millions of data points that it collects so 
that it can provide real-time reporting for 


teachers and administrators.””® 


Effective communication is critical, espe- 
cially since schools that have incorporated 
personalized learning strategies have relied 
on a mix of digital platforms. As one per- 
sonalized learning company executive put 
it, “The secret to successful implementation 
is an open, engaging, and ongoing partner- 
ship between technology providers, admin- 
istrators, and most importantly the teachers 
within a school or district? *” This feedback 
loop is impossible without a steady flow 

of information. Indeed, information is the 
linchpin of personalized learning. 


When configured well, personalized learn- 
ing technology gives teachers insights into 
student needs and lets them track each 


student’s progress. With the data pro- 
duced from student interactions with the 
technology, teachers “can more precisely 
pinpoint what students know and where 
they are still struggling at the moment 
they are struggling” and “can then use that 


information to drive better learning””** 


Personalized learning plans (PLPs) help 
schools and districts implement personaliza- 
tion. For example, California’s Thrive Public 
Schools and Summit Public Schools incorpo- 
rate student career goals, yearly performance, 
and academic plans in their PLPs. 


Vermont has incorporated PLPs into its 
broader education strategy. Under its 
flexible pathways law, the state works with 
every student in grades 7 through 12 in an 
ongoing process that yields, among other 
things, a PLP for achieving graduation and 
postsecondary and career goals.” Students 
revisit these plans at several points. The 
resulting PLPs include a student profile 
with self-identified strengths, weaknesses, 
interests, and core values; personal goals, 
current and beyond K-12; steps needed 

to achieve the personal goals; graduation 
requirements; and an academic plan based 
on the student’s expectations and goals. 


CICS West Belden, a K-8 charter school in 
the Chicago International Charter School 
(CICS) network, addressed a problem with 
plateaus in performance by adopting a PLP 
that combines student profiles and online 
platforms and focuses on social and emo- 
tional learning (SEL).*° West Belden used 
a ticket system to track traits linked to 

goal setting and self-direction and rewards 
students for demonstrating instances of 
“PRIDE”: problem solving, responsibility, 
integrity, drive, and empathy. 


By tracking SEL as well as academic data 
from both the online platforms and the 
PRIDE system, West Belden could quantify 
the impact of its program and report those 
results to its board, parents, and students. 
The school allots two hours a day for teach- 
ers to analyze the student data to identify 


opportunities for targeted small-group 
instruction and student strengths and 
weaknesses. Such a big allotment of time 

is necessary for at least two reasons. First, 
differentiated instruction should be more 
efficient than undifferentiated instruction, 
opening up more time for teachers to 
conduct data analysis. Second, data analysis 
exercises help ensure that student data are 
collected and used for a targeted, legitimate 
instruction purpose. This intentionality is 
an important part of responsible student 
data use and student data privacy. 


STATE POLICIES SUPPORTING 
PERSONALIZED LEARNING 

Rich student data provide a picture of the 
whole student—where they are in their learn- 
ing progressions; their strengths, interests, 
and needs; and where they need to grow. 
While data of the variety described above can 
inform academic choices and career goals, 
those who view personalized learning with 

a wary eye are more likely to be concerned 
about two things: biometrics and the meta- 
data that result from student interactions 
with the many dashboards and platforms 
found among the spectrum of personalized 
learning tools. Student records that contain 
such information are arguably more sensitive 
than academic performance data or a few 
sentences on career aspirations in a PLP. 


Biometrics refers to the measurement of 
individual physiological and behavioral 
characteristics. In addition to the classic 
biometric identifier, the fingerprint, there 

are many identifiers potentially associated 
with personalized learning: voice recordings, 
facial recognition, and eye movement and 
motion trackers.*! Such data are incredibly 
personal—but for those seeking to individu- 
alize education, that’s the idea. The prospect 
of ungoverned access to these data has raised 
serious concerns and corresponding advoca- 
cy and policy recommendations to address 
the lure of “personalization” in the context of 
technology advances, lax regulation, and the 
collection of enormous amounts of personal 
data that “overwhelm efforts to protect chil- 
dren's privacy.” 
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To advance personalized learning, state 
policymakers need to develop laws and 
policies that balance data privacy concerns 
with efficient, effective access to data for 
leaders, teachers, parents, and students. 


The Every Student Succeeds Act (ESSA) 
has given states and districts more latitude 
to lead and innovate and represents a dra- 
matic opportunity for states interested in 
personalized learning strategies. According 
to Richard Culatta, Rhode Island’s chief in- 
novation officer, “With [ESSA’s] additional 
flexibility, we are up at the front of the line 
taking advantage of it?”*’ Indeed, states 

are in the driver's seat, because for their 
part, and with few exceptions, the federal 
government is prohibited under several 
statutes from collecting, and creating a 
database of, personally identifiable student 
information (PII).** Consequently, indi- 
vidual states are responsible for collecting, 
storing, and processing student data. 


Yet several states have passed laws that 
unwittingly hamper personalized learning 
by preventing teachers from accessing 
information about their pupils’ progress. 
The impetus behind these moratoriums 

is a desire to protect student privacy. In 
contrast, other states have developed 
secure approaches for using student data to 
inform personalized learning while taking 
privacy concerns seriously. To guide state 
legislation on a systems approach to effec- 
tive use of data, the Data Quality Campaign 
advocates for four priorities: 1) measure 
what matters; 2) make data use possible; 3) 
be transparent and earn trust; and 4) guar- 
antee access and protect privacy.* 


Successfully integrating student data 
privacy and access to student information 
unlocks the true potential of personalized 
learning—leveraging teachers’ full potential 
while putting students on a trajectory to 
realize their own. Select states are instruc- 
tive in this regard. Louisiana, California, 
and Kansas provide instances of addressing 
privacy concerns without hamstringing 
potentially beneficial uses of data in the 


classroom. Florida and New Hampshire 
offer case studies of well-intentioned 
restrictions that smother opportunity yet 
offer little progress on protecting student 
privacy in exchange. 


Louisiana 

Louisiana has two main student data pri- 
vacy laws: LSA R.S. 17 § 3914 and § 3913. 
The latter concerns the transfer of student 
PII and deals mostly with the transpar- 
ency of the state’s student data practices. 
The former law defines PII as “informa- 
tion about an individual that can be used 
on its own or with other information to 
identify ... a single individual.”** This 
information includes “[a]ny information 
that can be used to distinguish or trace an 
individual’s identity such as . . . biometric 
records ... [and] any other information 
that is linked or linkable to an individu- 
al such as medical, educational, ... and 
employment information.” The act then 
states that PII shall not be provided to any 
entity, public or private. 


The law allows five exceptions to this pro- 
hibition. The four most relevant are 1) a 
student’s unique ID number;* 2) student 
PI provided to the state’s department of 
education for “satisfying state and federal 
assessment, auditing, funding, monitor- 
ing, program administration, and state 
accountability requirements” that has 
been aggregated to the point where it is 
deidentified; 3) student PH to “any person 
or public or private entity” after written 
authorization by a parent/legal guardian, 
student upon reaching the age of legal 
majority, or person otherwise authorized 
by the state, so long as that information 
shall remain confidential, the intentional 
breach of which will expose the actor to 
civil and criminal liability;** and 4) to 
allow for the transfer of student infor- 
mation, such as in the case of a student 
transferring from one school district to 
another. Moreover, the law also allows for 
access to certain limited “student infor- 
mation” based on the user’s role.*” 


Finally, the law allows for school districts 
to contract with private third parties to 
provide them with student information 
for “student and other education services,” 
provided that these third parties limit the 
handling and disclosure of such data to 
the four corners of the contract between 
the third party and the district. The law 
provides six minimum requirements for 
these contract provisions: 1) guidelines for 
student information access and authori- 
zation; 2) privacy compliance standards; 
3) internal privacy and security audits; 4) 
data breach planning, notification, and re- 
mediation procedures; 6) data governance 
policies for information storage, retention, 
and disposition; and 6) a provision for 

the deletion of all data held by the con- 
tractor upon termination of the contract. 
Violation of any of these provisions could 
lead to serious criminal and civil liability. 


Three aspects mark Louisiana’s commend- 
able approach to student data privacy. 
First, the law acknowledges students’ 

right to privacy in their personal informa- 
tion and backs up that proposition with 
criminal and civil penalties for breaches. 
Second, the state appropriately takes the 
position that the disclosure of data is a de- 
cision that should be left up to the affected 
individual and made on a case-by-case 
basis. Third, Louisiana law puts pressure 
on the state, districts, and the entities with 
which they contract to ensure that appro- 
priate security and privacy precautions are 
accounted for in any agreements between 
the parties. Importantly, the law emphasiz- 
es the use of modern security and privacy 
protections without being overly prescrip- 
tive, allowing for follow-on policies that 
adapt to changes in standards and best 
practices in a manner that legislation can- 
not. The result is an approach that relies on 
such best-practice principles as adopting 
data use restrictions and differentiating 
between levels of data sensitivity while 
avoiding a game of Whack-A-Mole or 
outright bans. In combination with trans- 
parency regarding what data are collected 
and how they are used, Louisiana’s strategy 
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allows students a level of personalization 
they find appropriate. 


California 

California’s new student data privacy 

law is seen as the most comprehensive 
state effort to balance access and priva- 

cy concerns and offers promising ways 

to reconcile data privacy with multiple 
competing interests such as educational 
research, technology innovation, and 
industry. Praised as solutions to “a growing 
problem of mismanagement of student 
data; California passed two bills in 

2014 that have had major implications for 
student data governance. The first of these, 
California Assembly Bill 1584, concerns 
the privacy of student records with regards 
to third-party operator contracts.*' The 
law requires that contracts entered into 
with third parties include specific provi- 
sions, including a “statement that the pupil 
records continue to be the property of and 
under the control of the local education 
agency (LEA), [and] a description of the 
actions the [third party] will take to ensure 
the security and confidentiality of pupil 
records.” In addition, failure on the part of 
third-party contractors to comply with the 
provisions contained within the statute will 
result in the contract to use the student 
data becoming void. 


AB 1584 defines pupil records to include 
“any information acquired directly from the 
pupil through the use of instructional soft- 
ware or applications assigned to the pupil by 
a teacher or other local educational agency 
employee.” However, it excludes deidenti- 
fied information that is used to “improve 
education products for adaptive learn- 

ing purposes and for customizing pupil 
learning,’ as well as deidentified data used 
to either demonstrate product effectiveness 
for the operator’s marketing purposes and 
for “the development and improvement of 
educational sites, services, or applications.” 


The second relevant student record law 
from California is known as the Student 
Online Personal Information Protection 


Act (SOPIPA).” This is considered a model 
law for addressing the issue of education- 
al data mining (EDM), the increasingly 
sophisticated use of data analytics that has 
generated many innovations in educational 
software and student learning.” The chal- 
lenge is to enable research and develop- 
ment of high-quality solutions in academia 
and industry—and validation of their 
effectiveness—while protecting student 
privacy. Although they are intended to 
protect students, complete bans on reten- 
tion of personally identifiable information 
(PID), or requirements to delete all data af- 
ter specified periods, may actually do harm 
by impeding innovation that can lead to 
advances in EDM to improve student out- 
comes. Instead, as recommended by EDM 
expert Ryan Baker, “PII mappings should 
be held in trust by school districts or by 
other entities, under careful control, but 
used when there is a good justification for 


benefit and careful controls of privacy.” 


When SOPIPA was passed (as Senate 

Bill 1177), it was labeled one of the most 
aggressive protections for student data in 
the country and as a potential nationwide 
legislative model.* SOPIPA has proved 
popular: 25 states modeled their student 
records legislation after it in 2015, and 
more such legislation followed in subse- 
quent legislative sessions.** Since 2014, 21 
states passed laws based on SOPIPA.”” 


SOPIPA applies to operators of websites 
and online and mobile apps that cater 

to K-12 schools.** Subject to a few dis- 
crete exceptions, SOPIPA prevents these 
operators from leveraging their access to 
student data to “knowingly engage” in a 
range of activities prohibited by the statute, 
including targeted advertising, amassing 
student profiles, selling, or otherwise dis- 
closing covered student information. The 
law also requires operators to protect and 
secure student information through the 
implementation and maintenance of “rea- 
sonable security procedures and practices 
appropriate to the nature of the covered 
information.” Finally, SOPIPA contains 


a deletion clause requiring operators to 
delete covered student data if requested by 
a school to do so. 


Despite these rigorous protections, SOPIPA 
does not completely divest operators 

of benefits inherent in the student data 
they possess. For example, an operator is 
permitted to use deidentified student data 
to improve its own products or to demon- 
strate, through marketing or otherwise, the 
effectiveness of their product or service. In 
addition, the law does not prevent com- 
panies from directing marketing efforts at 
parents, so long as those efforts do not stem 
from PII that such companies may have 
obtained from students. Nor does the law 
hinder operators from using student data, 
including PII, “for adaptive learning or cus- 
tomized student learning purposes”—such 
as personalized learning. 


Kansas 

Kansas’s Student Data Privacy Act was 
passed into law in 2014 to address gaps in 
student data privacy protection. Unlike the 
legislation in Louisiana and California, the 
act specifically defines “student data” and 
“personally identifiable student data. ” 
The statute provides that student data may 
be disclosed to a service provider of a state 
or local education agency “engaged to per- 
form a function of instruction, assessment 
or longitudinal reporting, provided there 
is a data-sharing agreement between the 
[SEA or LEA and the] service provider” 
The statute further states that the agree- 
ment must contain at least four provisions: 
1) purpose, scope, and duration of the 
agreement; 2) that the recipient of the stu- 
dent data use such information solely for 
the purposes specified in the agreement; 
3) that the recipient shall comply with data 
access, use, and security restrictions spe- 
cifically described in the agreement; and 
4) that the student data shall be destroyed 
when no longer necessary or upon the 
expiration of the agreement. 


The Kansas statute makes allowances 
for teacher as well as other LEA or SEA 
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employee access to student data based on 
need and user roles. Moreover, it address- 
es the collection of student biometric 
data: “No school district shall collect 
biometric data from a student, or use any 
device or mechanism to assess a student’s 
physiological or emotional state, unless 
the student, if an adult, or the parent or 
legal guardian of the student, if a minor, 
consents in writing.” 


Florida 

Unlike the states discussed above, whose 
protection of student data provides ave- 
nues for personalized learning, Florida 
effectively closes the door. Under a 2014 
law, an agency or board may not “[c]ollect, 
obtain, or retain information on the polit- 
ical affiliation, voting history, religious af- 
filiation, or biometric information of a stu- 
dent or a parent or sibling of the student.*! 
The law defines biometric information as 
“information collected from the electronic 
measurement or evaluation of any physical 
or behavioral characteristics that are attrib- 
utable to a single person.” This list includes 
“fingerprint characteristics, hand charac- 
teristics, eye characteristics, vocal charac- 
teristics, and any other physical character- 
istics used for the purpose of electronically 
identifying that persona with a high degree 
of certainty.’ The law furthermore provides 
that examples of such biometrics might 
include “a fingerprint or hand scan, a 
retina or iris scan, a voice print, or a facial 
geometry scan.” 


The technologies teachers rely on to help 
personalize learning could well qualify as 
biometric information under Florida’s stat- 
utory definition and therefore be banned. 
Because lawmakers included no statements 
on personalized learning itself, an inten- 
tional ban seems unlikely. Yet the effect on 
classroom use is the same. 


New Hampshire 

Under New Hampshire's student data pri- 
vacy law, the SEA may neither collect nor 
maintain a comprehensive list of student 
data.” Furthermore, the state prohibits the 


collection and storage of student biometric 
information. Although the state prohibits 
collection of student height, body mass in- 
dex, and weight separately, New Hampshire 
defines other biometric information as “a 
record of one or more biological or behav- 
ioral characteristics that can be used for 
automated recognition of an individual” 


Another New Hampshire statute governs 
student online personal information. 
Under this law, operators of online web- 
sites, services, applications, and mobile 
apps with “actual knowledge that the site, 
service, or application is used primarily for 
K-12 school purposes and was designed 
and marketed” for such purposes are 
prohibited from knowingly engaging in 
several actions with personally identifiable 
student information, including targeted 
advertising or using the information to 
amass a profile about the student.” 


In effect, the New Hampshire law protects 
against the extremes of student data ex- 
ploitation at the expense of more nuanced, 
academically beneficial uses. The state 
arguably achieves its aims of protecting 
students by preventing the “sale, lease, 
rent, trade, or otherwise” of student data. 
In conjunction with its ban against using 
student data for targeted advertising, the 
law essentially limits the use of any collect- 
ed data to strictly educational uses. 


However, the law goes too far by pre- 
venting companies from, for example, 
amassing a profile about students through 
the use of any information, including 
deidentified data, as no such distinction 
is made. Such profiles underlie efforts to 
differentiate learning from one student 

to the next. It may indeed be laudable to 
prevent education technology companies 
from using the DNA of New Hampshire 
students for educational purposes. But a 
broad definition of biometric data and an 
outright ban on the collection of all but a 
few traditional data points (such as height 
and weight) prevent New Hampshire 
foreign language students, for example, 


from using learning software that evaluates 
their effectiveness at speaking the language 
and other students from using software 
that stores images of student handwriting, 
which can range from essay drafts to math 
equations to attendance checkmarks. All of 
it is “biometric data” 


LESSONS LEARNED 

What divides legislation that fosters per- 
sonalized learning from laws that ham- 
string it is clear. Legislation that stymies 
personalized learning programs takes 
choice away from parents and students 
regarding their learning opportunities. 
Laws that take a more measured approach 
let schools track student information with 
the proper consent of students and parents 
and thereby give space for personalization 
to schools, districts, and organizations 
working with them. 


New Hampshire's state law is among the 
greatest offenders, with its heavy-handed 
provisions to prevent critical student data 
from being stored and analyzed in their 
state longitudinal data system (SLDS). 
There is no doubt that the law is well inten- 
tioned and contains some sound provisions, 
such as protecting information on student 
sexual orientation, credit card accounts, 
and political affiliations. Other provisions, 
however, go too far. 


Consider the state’s policy on data collec- 
tion. First, the policy lacks a provision to 
allow a parent, guardian, or student to opt 
in to educational programs that might re- 
quire the collection and analysis of student 
information that the state bars. Second, 

its definition of biometric information is 
much too broad and effectively throws the 
baby out with the bathwater. 


Furthermore, restricting the collection 

of “behavioral characteristics” that might 
be used for automated recognition of an 
individual would likely prevent a school 
from collecting metadata from an online 
tutoring program, for example.” This 
would prevent SEAs, researchers, and thus 
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students themselves from benefiting from 
a range of detailed feedback on their learn- 
ing. As confusingly broad as the “behav- 
ioral characteristics” restriction is, another 
provision of New Hampshire's law piles on, 
preventing online or mobile services from 
using information that could be used to 
personally identify a student.°° 


New Hampshire's prohibition on sharing 
information that could be linked to a 
particular student in effect prevents per- 
sonalized learning from occurring at all. 
Simply put, if these tools cannot identify a 
student's input or responses, they cannot 
personalize the education experience. 


New Hampshire officials have nonethe- 
less expressed their desire to implement 
personalized learning programs in the 
state’s schools—an effort that the U.S. 
Department of Education describes as 

“a high school redesign that replaces the 
time-based system (Carnegie unit) with 
a competency-based system focused on 
personalized learning, strong teacher-stu- 
dent relationships, flexible supports, and 
development of 21st century skills.”*” As 
other states have done, New Hampshire 
plans to deploy a personalized learning 
plan template. Interestingly, the template 
appears to ask for information that state 
law prohibits its SEA from collecting.** 


Florida's law is similarly well intentioned 
and similarly short-sighted. While it does 
not restrict student data collection and 
use to the extent that New Hampshire's 
does, it is particularly restrictive on the 
collection of biometric records. As one 

of the most sensitive categories of stu- 
dent information, its protection should 
be a high priority. Indeed, one can easily 
imagine why parents, students, and their 
state representatives might feel the need to 
limit the ability of schools or third parties 
to collect and store facial geometry or iris 
scans. However, by preventing the SEA or 
affiliated institutions from collecting and 
evaluating “information collected from 
the electronic measurement or evaluation 


of any physical or behavior characteristics 
that are attributable to a single person,” 
Florida also prevents families from making 
decisions about their data and potentially 
withholds opportunities from students. 
The law fails to leave room for perfectly 
appropriate and frankly exciting ways to 
leverage a student’s information for their 
academic benefit. 


There is another way forward—one that 

is both responsible and avoids taking a 
hands-off approach to potentially exploit- 
ative uses of data. While this report focus- 
es on data privacy, policymakers should 
address the full range of issues to enable 
equal access for all students to high-quality 
personalized learning. 


As discussed above, Louisiana is an example 
of a state approach that is quite restrictive 
with its students’ biometric records but lets 
parents and students choose whether to opt 
into such data collections. They thus protect 
their students while leaving it up to them 
and their families to determine their level of 
comfort with the information they share. 


The problems Florida and New 
Hampshire's laws seek to prevent could 
further be avoided with an explicit state- 
ment like that in California's SB 1177, 
which regulates the collection of biometric 
and other personally identifiable informa- 
tion but affirms that nothing within the 
law should be read to limit personalized 
learning. Finally, Kansas’s law, which has 
provisions that define both personally 
identifiable student data and biometric 
data like Florida and New Hampshire’, 
provides room for personalized learn- 

ing by employing the same strategy as 
Louisiana and allowing parents and stu- 
dents to opt into data use and collection. 
Kansas further balances privacy protection 
and promotion of personalized leaning by 
conditioning the state’s use and analysis of 
student records it collects and maintains 
on compliance with strict (but not restric- 
tive) predefined contractual agreements. 


One additional model for state legislation 
is Ilinois’s Biometric Information Privacy 
Act (BIPA).* Although the law may not 
be a perfect solution, it addresses concerns 
that biometric data constitute a particular- 
ly sensitive variety of student data and thus 
should be treated differently from other 
student records. Rather than restrict what 
information can be collected—a strategy 
that likely will require regular updat- 

ing as norms and values change—BIPA 
emphasizes consent. Under BIPA, private 
companies are barred from “collecting, 
capturing, purchasing, receiving through 
trade, or otherwise obtaining a customer's 
biometric identifier or biometric informa- 
tion unless it first” obtains the individual’s 
written consent. 


Furthermore, BIPA limits unintended 
consequences—something several other 
laws fail to achieve—by expressly excluding 
“writing samples, written signatures, pho- 
tographs [and] human biological samples 
used for valid scientific testing or screen- 
ing, demographic data, tattoo descriptions, 
or physical descriptions such as height, 
weight, hair color, or eye color.” BIPA re- 
quires the company collecting and storing 
biometric data to have a written policy on 
storing and eventually destroying the data, 
a measure that could alleviate some secu- 
rity concerns on the disposition of student 
data. Although BIPA does not specifically 
address personalized learning or student 
records, it would govern third parties, in- 
cluding vendors that provide personalized 
learning platforms and technology, and it 
allows state boards of education the leeway 
to promulgate separate policies and regula- 
tions for state and local education agencies. 


POLICY RECOMMENDATIONS 

State boards of education have a responsi- 
bility to ensure the security of state and local 
student data collection. They also have the 
unprecedented opportunity through ESSA to 
“lead with equity; working with other state 
policymakers to enable personalized learning 
and technology innovation to improve 
student outcomes. They may fulfill these 
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dual responsibilities by ensuring compliance 
with existing laws, policies, and regulations; 
reshaping policy; and engaging public stake- 
holders to raise awareness. 


Although state board and governance 
contexts may differ across states, boards 
are united in their role as the citizen’s voice 
in education. They have three powers for 
leading in this role: policy, questioning, 
and convening. They can hold public and 
private convenings to discuss issues and 
pose questions to experts, state agencies, 
and community stakeholders. These 
powers are particularly important where 
overbearing legislation to impose data 
restrictions produces unintended conse- 
quences and threatens to stifle innovation. 
Moreover, convening is especially effective 
in states where the law requires general 
protections but leaves the specifics of im- 
plementation up to state boards and their 
state and district colleagues. 


Yet many state boards of education paid 
little attention to data issues and personal- 
ized learning over the past year, according 


to NASBE’s State Board Insight database, 
even as many state education agencies and 
state legislatures grapple with these issues. 
For example, education technology ranks 
low among topics on state board agen- 
das. In contrast to the frenzy of activity 
surrounding privacy and student data on 
the part of stakeholders and state legisla- 
tors, only 14 state boards have discussed 
data generally since 2015, and only 4 dis- 
cussed “alternative education” during the 
same period. In states such as Vermont, 
Texas, and Rhode Island, districts and 
schools have initiated many of the efforts 
to explore personalized learning. While 
boards have many important items on the 
agendas, they ought also consider data 
privacy issues in order to safeguard the 
access needed for realizing the promise of 
personalized learning for all students. 


State boards can consider several key 
policies and actions to address these issues. 
First, boards should make personalized 
learning a strategic priority because it can 
dramatically improve academic perfor- 
mance, graduation rates, postsecondary 


outcomes, and teacher morale and because 
it affects protection of student data privacy 
and use of student information. State 
board members should build support for 

a shared vision of personalized learning. 
This can be accomplished, for example, by 
directing community and media attention 
to success stories of data use and personal- 
ized learning (box 3). They can also foster 
support and trust by inviting stakeholders 
to witness and visit districts that are en- 
gaged in personalized learning initiatives 
and that also have responsible, successful 
data protection strategies. 


Tennessee’s education department offers 

a leading model for boards to consider. Its 
Office of Personalized Learning works with 
school districts to support the use of virtu- 
al, distance, and blended learning models. 
This includes convening an Innovative 
Educator Network of 50 high-perform- 

ing educators and librarians, along with 
experts and researchers, to discuss and im- 
plement personalized learning strategies. 


Second, to raise public awareness, state 


What Personalized Learning Looks Like 


William Smith High School in Aurora, Colorado, serves a di- 
verse group of 305 students (60 percent are disadvantaged) who 
seek a personalized education. Authentic, real-world problems 
and issues drive project-based learning and service learning 
opportunities. William Smith partners with the local University 
of Colorado Anschutz medical campus in health science 
programs, offers dual enrollments with community colleges, 
uses adjunct arts and fitness instructors, and requires seniors 

to complete a capstone project, in which they often have adult 
mentors from the community. 


Teachers spend Friday afternoons collaborating and develop- 
ing projects. Staff frequently adjust courses and schedules to 
flexibly allocate time as learning opportunities arise. Students 
are also involved in curriculum planning, and their inquiries 
often prompt subsequent topics of study with multi-grade-level 
classes. Teachers differentiate their instruction to accommodate 


all learners in each class, and all students have access to any 
course in which they are interested. Assessments are conducted 
in myriad ways, including showcases, community presenta- 
tions, dramatic performances, Socratic seminars, and written 
portfolios. 


Students of color and students who receive free and reduced 
lunch succeed at rates equal to, or higher than, the rest of their 
peers. The school boasts a 90 percent graduation rate—92 per- 
cent for minorities—and both of those rates are the highest in 
the district. “When we teach interesting things and engage kids 
in the work of professionals, learning will follow,’ said Principal 
David Roll. 


Source: Drawn from Kevin Welner and Linda Molner Kelley, Answer Sheet 
blog, Washington Post (November 14, 2016). 
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boards should take a leading role in ad- 
vocating for easy-to-understand informa- 
tion that helps parents and others learn 
how data are being used and protected. 
According to a September 2015 study 

by the Future of Privacy Forum, “Most 
parents believe that using student data, 
both in the aggregate and individually, is 
an appropriate (and perhaps constructive) 
way to evaluate and improve education.” 
An overwhelming number of parents, 79 
percent, believe that it is acceptable to use 
individual student data to personalize the 
learning process by identifying student 
strengths and weaknesses.”! 


With the renewed call in ESSA to engage 
the full suite of stakeholders, state boards 
can involve not just parents and students but 
also local policy and advocacy organizations 
and private companies in the personalized 
learning space to discuss how to achieve the 
best balance between protection and innova- 
tion. Building consensus for a shared vision 
of how data and privacy concerns should 

be managed in the context of education will 
undoubtedly provide the leverage to effect 
considerable positive change. 


Third, many state boards have significant 
legal authority over education data privacy 
(Alabama, Utah, and West Virginia, for 
example) and should use it to ensure stu- 
dent data access and privacy. In addition, 
state boards can take advantage of their 
authority to pass binding and nonbinding 
resolutions, which almost all state boards 
of education have. This authority is most 
effective in situations where a law grants 
state boards the responsibility to clarify 
best practices and procedures or when 
changing technology and its applications 
have rendered a law out of date. 


Student information can be a significant 
aid to academic growth and performance, 
but only if there is a sufficient degree of 
access to the data to spark that transforma- 
tion. Without the key elements of trust and 
transparency, such a trade-off between ac- 
cess and protection cannot occur. When it 


comes to something as sensitive as student 
data, trust is not to be taken for granted, 
nor is it given lightly. 


Fourth, boards should use their conven- 
ing power to monitor and act on these 
issues. It is not easy but it is possible to 
earn the latitude that community trust 
affords—through transparent practices and 
protection of student data—and still allow 
for responsible information use to facili- 
tate personalized learning. If classrooms 
are to pivot toward more personalized 
learning, it will take a collaborative effort. 
State board members are best positioned 
to bring together disparate stakeholders in 
the community, schools, and government 
for such collaboration. 


They need not go it alone, as they can draw 
from many excellent resources. Multiple 
organizations and coalitions exist for the 
sole purpose of assisting schools and dis- 
tricts in achieving the responsible trade-off 
at the heart of this issue. 


Finally, state boards can turn to 10 princi- 
ples for using and safeguarding students’ 
personal information, which NASBE aided 
in drafting (box 4). The principles reflect 

a vision centered around the effective use 
of data to support student learning and 
success and the critical importance of 
protecting that data. State board members 
can use these principles as a touchstone in 
their efforts to support personalized learn- 
ing efforts and responsible data practices 
in their states. 


The opportunities to accelerate student 
achievement through a more personalized 
learning experience are abundant. With 
the passionate involvement and vision of 
state boards of education, the promise of 
21st century learning can be realized for 
each and every student. 


William Tucker was NASBE’s program 
manager for education data and technology, 
and Don Long is project director for teach- 
ing, leading, and learning. 
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Ten Foundational Principles for Using 
and Safeguarding Students’ Personal 
Information 


¢ Student data should be used to further and support student learning and success. 


¢ Student data are most powerful when used for continuous improvement and personalizing 
student learning. 


¢ Student data should be used as a tool for informing, engaging, and empowering students, 
families, teachers, and school system leaders. 


¢ Students, families, and educators should have timely access to information collected about 
the student. 


Student data should be used to inform and not replace the professional judgment of educa- 
tors. 


e Students’ personal information should only be shared, under terms or agreement, with ser- 
vice providers for legitimate educational purposes; otherwise the consent to share must be 
given by a parent, guardian, or a student, if that student is over 18. School systems should 
have policies for overseeing this process, which include support and guidance for teachers. 


¢ Educational institutions, and their contracted service providers with access to student 
data, including researchers, should have clear, publicly available rules and guidelines for 
how they collect, use, safeguard, and destroy those data. 


¢ Educators and their contracted service providers should only have access to the minimum 
student data required to support student success. 


Everyone who has access to students’ personal information should be trained and know 
how to effectively and ethically use, protect, and secure it. 


¢ Any educational institution with the authority to collect and maintain student personal 
information should 


a. have a system of governance that designates rules, procedures, and the individual or group 
responsible for decisionmaking regarding data collection, use, access, sharing, and security, and 
use of online educational programs; 


b. have a policy for notification of any misuse or breach of information and available remedies; 
c. maintain a security process that follows widely accepted industry best practices; 


d. provide a designated place or contact where students and families can go to learn of their rights 
and have their questions about student data collection, use, and security answered. 


Source: Data Quality Campaign. 
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